Git Plugin connects to a user-specified Git repository as part of form validation.
Priority LOW 34CWE-352Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Tampering
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 1 fixed, 1 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-352.
Summary
Git Plugin connects to a user-specified Git repository as part of form validation. An attacker with no direct access to Jenkins but able to guess at a username/password credentials ID could trick a developer with job configuration permissions into following a link with a maliciously crafted Jenkins URL which would result in the Jenkins Git client sending the username and password to an attacker-controlled server.
Why it matters now
EPSS 0.00769 55th percentileScored 2026-11-07
Fix Partial org.jenkins-ci.plugins:git (Maven): 3.3.2Red Hat: 1 fixed, 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.jenkins-ci.plugins:git (Maven) | before 3.3.2 | 3.3.2 | Patch available | GHSA-rf5q-8gx3-xqfc |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.jenkins-ci.plugins:git (Maven) Vendor— Affected before 3.3.2 Fixed in 3.3.2 Patch available GHSA-rf5q-8gx3-xqfc
CPE configurations NVD · 124
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:jenkins:git:0.1.0:*:*:*:*:jenkins:*:* | 0.1.0 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:0.2.0:*:*:*:*:jenkins:*:* | 0.2.0 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:0.3.0:*:*:*:*:jenkins:*:* | 0.3.0 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:0.4.0:*:*:*:*:jenkins:*:* | 0.4.0 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:0.5.0:*:*:*:*:jenkins:*:* | 0.5.0 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:0.6.0:*:*:*:*:jenkins:*:* | 0.6.0 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:0.7.0:*:*:*:*:jenkins:*:* | 0.7.0 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:0.7.1:*:*:*:*:jenkins:*:* | 0.7.1 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:0.7.2:*:*:*:*:jenkins:*:* | 0.7.2 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:0.7.3:*:*:*:*:jenkins:*:* | 0.7.3 | Vulnerable | Jenkins |
- cpe:2.3:a:jenkins:git:0.1.0:*:*:*:*:jenkins:*:* Versions 0.1.0 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:0.2.0:*:*:*:*:jenkins:*:* Versions 0.2.0 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:0.3.0:*:*:*:*:jenkins:*:* Versions 0.3.0 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:0.4.0:*:*:*:*:jenkins:*:* Versions 0.4.0 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:0.5.0:*:*:*:*:jenkins:*:* Versions 0.5.0 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:0.6.0:*:*:*:*:jenkins:*:* Versions 0.6.0 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:0.7.0:*:*:*:*:jenkins:*:* Versions 0.7.0 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:0.7.1:*:*:*:*:jenkins:*:* Versions 0.7.1 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:0.7.2:*:*:*:*:jenkins:*:* Versions 0.7.2 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:0.7.3:*:*:*:*:jenkins:*:* Versions 0.7.3 Vulnerable ·Jenkins
Show 114 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:jenkins:git:0.8.0:*:*:*:*:jenkins:*:* | 0.8.0 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:0.8.1:*:*:*:*:jenkins:*:* | 0.8.1 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:0.8.2:*:*:*:*:jenkins:*:* | 0.8.2 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:0.9.0:*:*:*:*:jenkins:*:* | 0.9.0 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:0.9.1:*:*:*:*:jenkins:*:* | 0.9.1 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:0.9.2:*:*:*:*:jenkins:*:* | 0.9.2 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:1.0.0:*:*:*:*:jenkins:*:* | 1.0.0 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:1.0.1:*:*:*:*:jenkins:*:* | 1.0.1 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:1.1.0:*:*:*:*:jenkins:*:* | 1.1.0 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:1.1.1:*:*:*:*:jenkins:*:* | 1.1.1 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:1.1.2:*:*:*:*:jenkins:*:* | 1.1.2 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:1.1.3:*:*:*:*:jenkins:*:* | 1.1.3 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:1.1.4:*:*:*:*:jenkins:*:* | 1.1.4 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:1.1.5:*:*:*:*:jenkins:*:* | 1.1.5 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:1.1.6:*:*:*:*:jenkins:*:* | 1.1.6 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:1.1.7:*:*:*:*:jenkins:*:* | 1.1.7 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:1.1.8:*:*:*:*:jenkins:*:* | 1.1.8 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:1.1.9:*:*:*:*:jenkins:*:* | 1.1.9 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:1.1.10:*:*:*:*:jenkins:*:* | 1.1.10 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:1.1.11:*:*:*:*:jenkins:*:* | 1.1.11 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:1.1.12:*:*:*:*:jenkins:*:* | 1.1.12 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:1.1.13:*:*:*:*:jenkins:*:* | 1.1.13 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:1.1.14:*:*:*:*:jenkins:*:* | 1.1.14 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:1.1.15:*:*:*:*:jenkins:*:* | 1.1.15 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:1.1.16:*:*:*:*:jenkins:*:* | 1.1.16 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:1.1.17:*:*:*:*:jenkins:*:* | 1.1.17 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:1.1.18:*:*:*:*:jenkins:*:* | 1.1.18 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:1.1.19:*:*:*:*:jenkins:*:* | 1.1.19 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:1.1.20:*:*:*:*:jenkins:*:* | 1.1.20 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:1.1.21:*:*:*:*:jenkins:*:* | 1.1.21 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:1.1.22:*:*:*:*:jenkins:*:* | 1.1.22 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:1.1.23:*:*:*:*:jenkins:*:* | 1.1.23 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:1.1.24:*:*:*:*:jenkins:*:* | 1.1.24 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:1.1.25:*:*:*:*:jenkins:*:* | 1.1.25 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:1.1.26:*:*:*:*:jenkins:*:* | 1.1.26 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:1.1.27:*:*:*:*:jenkins:*:* | 1.1.27 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:1.1.28:*:*:*:*:jenkins:*:* | 1.1.28 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:1.1.29:*:*:*:*:jenkins:*:* | 1.1.29 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:1.2.0:*:*:*:*:jenkins:*:* | 1.2.0 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:1.3.0:*:*:*:*:jenkins:*:* | 1.3.0 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:1.4.0:*:*:*:*:jenkins:*:* | 1.4.0 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:1.5.0:*:*:*:*:jenkins:*:* | 1.5.0 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:1.6.0:beta-1:*:*:*:jenkins:*:* | 1.6.0 beta-1 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:2.0.0:*:*:*:*:jenkins:*:* | 2.0.0 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:2.0.0:alpha-1:*:*:*:jenkins:*:* | 2.0.0 alpha-1 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:2.0.0:alpha-2:*:*:*:jenkins:*:* | 2.0.0 alpha-2 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:2.0.0:beta-2:*:*:*:jenkins:*:* | 2.0.0 beta-2 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:2.0.0:beta-3:*:*:*:jenkins:*:* | 2.0.0 beta-3 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:2.0.1:*:*:*:*:jenkins:*:* | 2.0.1 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:2.0.2:*:*:*:*:jenkins:*:* | 2.0.2 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:2.0.3:*:*:*:*:jenkins:*:* | 2.0.3 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:2.0.4:*:*:*:*:jenkins:*:* | 2.0.4 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:2.1.0:*:*:*:*:jenkins:*:* | 2.1.0 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:2.2.0:*:*:*:*:jenkins:*:* | 2.2.0 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:2.2.1:*:*:*:*:jenkins:*:* | 2.2.1 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:2.2.2:*:*:*:*:jenkins:*:* | 2.2.2 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:2.2.3:*:*:*:*:jenkins:*:* | 2.2.3 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:2.2.4:*:*:*:*:jenkins:*:* | 2.2.4 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:2.2.5:*:*:*:*:jenkins:*:* | 2.2.5 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:2.2.6:*:*:*:*:jenkins:*:* | 2.2.6 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:2.2.7:*:*:*:*:jenkins:*:* | 2.2.7 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:2.2.8:*:*:*:*:jenkins:*:* | 2.2.8 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:2.2.9:*:*:*:*:jenkins:*:* | 2.2.9 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:2.2.10:*:*:*:*:jenkins:*:* | 2.2.10 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:2.2.11:*:*:*:*:jenkins:*:* | 2.2.11 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:2.2.12:*:*:*:*:jenkins:*:* | 2.2.12 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:2.3.0:*:*:*:*:jenkins:*:* | 2.3.0 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:2.3.0:beta-1:*:*:*:jenkins:*:* | 2.3.0 beta-1 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:2.3.0:beta-2:*:*:*:jenkins:*:* | 2.3.0 beta-2 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:2.3.0:beta-3:*:*:*:jenkins:*:* | 2.3.0 beta-3 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:2.3.0:beta-4:*:*:*:jenkins:*:* | 2.3.0 beta-4 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:2.3.1:*:*:*:*:jenkins:*:* | 2.3.1 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:2.3.2:*:*:*:*:jenkins:*:* | 2.3.2 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:2.3.3:*:*:*:*:jenkins:*:* | 2.3.3 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:2.3.4:*:*:*:*:jenkins:*:* | 2.3.4 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:2.3.5:*:*:*:*:jenkins:*:* | 2.3.5 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:2.4.0:*:*:*:*:jenkins:*:* | 2.4.0 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:2.4.1:*:*:*:*:jenkins:*:* | 2.4.1 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:2.4.2:*:*:*:*:jenkins:*:* | 2.4.2 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:2.4.3:*:*:*:*:jenkins:*:* | 2.4.3 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:2.4.4:*:*:*:*:jenkins:*:* | 2.4.4 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:2.5.0:*:*:*:*:jenkins:*:* | 2.5.0 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:2.5.0:beta-1:*:*:*:jenkins:*:* | 2.5.0 beta-1 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:2.5.0:beta-2:*:*:*:jenkins:*:* | 2.5.0 beta-2 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:2.5.0:beta-3:*:*:*:jenkins:*:* | 2.5.0 beta-3 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:2.5.0:beta-4:*:*:*:jenkins:*:* | 2.5.0 beta-4 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:2.5.0:beta-5:*:*:*:jenkins:*:* | 2.5.0 beta-5 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:2.5.1:*:*:*:*:jenkins:*:* | 2.5.1 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:2.5.2:*:*:*:*:jenkins:*:* | 2.5.2 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:2.5.3:*:*:*:*:jenkins:*:* | 2.5.3 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:2.6.0:*:*:*:*:jenkins:*:* | 2.6.0 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:2.6.1:*:*:*:*:jenkins:*:* | 2.6.1 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:2.6.2:*:*:*:*:jenkins:*:* | 2.6.2 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:2.6.2:beta-1:*:*:*:jenkins:*:* | 2.6.2 beta-1 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:2.6.2:beta-2:*:*:*:jenkins:*:* | 2.6.2 beta-2 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:2.6.4:*:*:*:*:jenkins:*:* | 2.6.4 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:2.6.5:*:*:*:*:jenkins:*:* | 2.6.5 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:3.0.0:*:*:*:*:jenkins:*:* | 3.0.0 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:3.0.0:beta-1:*:*:*:jenkins:*:* | 3.0.0 beta-1 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:3.0.0:beta-2:*:*:*:jenkins:*:* | 3.0.0 beta-2 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:3.0.1:*:*:*:*:jenkins:*:* | 3.0.1 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:3.0.2:*:*:*:*:jenkins:*:* | 3.0.2 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:3.0.2:beta-1:*:*:*:jenkins:*:* | 3.0.2 beta-1 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:3.0.2:beta-2:*:*:*:jenkins:*:* | 3.0.2 beta-2 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:3.0.3:*:*:*:*:jenkins:*:* | 3.0.3 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:3.0.4:*:*:*:*:jenkins:*:* | 3.0.4 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:3.0.5:*:*:*:*:jenkins:*:* | 3.0.5 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:3.1.0:*:*:*:*:jenkins:*:* | 3.1.0 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:3.2.0:*:*:*:*:jenkins:*:* | 3.2.0 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:3.3.0:*:*:*:*:jenkins:*:* | 3.3.0 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:3.3.1:*:*:*:*:jenkins:*:* | 3.3.1 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:3.4.0:alpha-1:*:*:*:jenkins:*:* | 3.4.0 alpha-1 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:3.4.0:alpha-4:*:*:*:jenkins:*:* | 3.4.0 alpha-4 | Vulnerable | Jenkins |
| cpe:2.3:a:jenkins:git:3.4.0:beta-1:*:*:*:jenkins:*:* | 3.4.0 beta-1 | Vulnerable | Jenkins |
- cpe:2.3:a:jenkins:git:0.8.0:*:*:*:*:jenkins:*:* Versions 0.8.0 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:0.8.1:*:*:*:*:jenkins:*:* Versions 0.8.1 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:0.8.2:*:*:*:*:jenkins:*:* Versions 0.8.2 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:0.9.0:*:*:*:*:jenkins:*:* Versions 0.9.0 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:0.9.1:*:*:*:*:jenkins:*:* Versions 0.9.1 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:0.9.2:*:*:*:*:jenkins:*:* Versions 0.9.2 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:1.0.0:*:*:*:*:jenkins:*:* Versions 1.0.0 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:1.0.1:*:*:*:*:jenkins:*:* Versions 1.0.1 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:1.1.0:*:*:*:*:jenkins:*:* Versions 1.1.0 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:1.1.1:*:*:*:*:jenkins:*:* Versions 1.1.1 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:1.1.2:*:*:*:*:jenkins:*:* Versions 1.1.2 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:1.1.3:*:*:*:*:jenkins:*:* Versions 1.1.3 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:1.1.4:*:*:*:*:jenkins:*:* Versions 1.1.4 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:1.1.5:*:*:*:*:jenkins:*:* Versions 1.1.5 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:1.1.6:*:*:*:*:jenkins:*:* Versions 1.1.6 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:1.1.7:*:*:*:*:jenkins:*:* Versions 1.1.7 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:1.1.8:*:*:*:*:jenkins:*:* Versions 1.1.8 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:1.1.9:*:*:*:*:jenkins:*:* Versions 1.1.9 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:1.1.10:*:*:*:*:jenkins:*:* Versions 1.1.10 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:1.1.11:*:*:*:*:jenkins:*:* Versions 1.1.11 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:1.1.12:*:*:*:*:jenkins:*:* Versions 1.1.12 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:1.1.13:*:*:*:*:jenkins:*:* Versions 1.1.13 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:1.1.14:*:*:*:*:jenkins:*:* Versions 1.1.14 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:1.1.15:*:*:*:*:jenkins:*:* Versions 1.1.15 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:1.1.16:*:*:*:*:jenkins:*:* Versions 1.1.16 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:1.1.17:*:*:*:*:jenkins:*:* Versions 1.1.17 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:1.1.18:*:*:*:*:jenkins:*:* Versions 1.1.18 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:1.1.19:*:*:*:*:jenkins:*:* Versions 1.1.19 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:1.1.20:*:*:*:*:jenkins:*:* Versions 1.1.20 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:1.1.21:*:*:*:*:jenkins:*:* Versions 1.1.21 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:1.1.22:*:*:*:*:jenkins:*:* Versions 1.1.22 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:1.1.23:*:*:*:*:jenkins:*:* Versions 1.1.23 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:1.1.24:*:*:*:*:jenkins:*:* Versions 1.1.24 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:1.1.25:*:*:*:*:jenkins:*:* Versions 1.1.25 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:1.1.26:*:*:*:*:jenkins:*:* Versions 1.1.26 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:1.1.27:*:*:*:*:jenkins:*:* Versions 1.1.27 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:1.1.28:*:*:*:*:jenkins:*:* Versions 1.1.28 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:1.1.29:*:*:*:*:jenkins:*:* Versions 1.1.29 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:1.2.0:*:*:*:*:jenkins:*:* Versions 1.2.0 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:1.3.0:*:*:*:*:jenkins:*:* Versions 1.3.0 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:1.4.0:*:*:*:*:jenkins:*:* Versions 1.4.0 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:1.5.0:*:*:*:*:jenkins:*:* Versions 1.5.0 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:1.6.0:beta-1:*:*:*:jenkins:*:* Versions 1.6.0 beta-1 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:2.0.0:*:*:*:*:jenkins:*:* Versions 2.0.0 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:2.0.0:alpha-1:*:*:*:jenkins:*:* Versions 2.0.0 alpha-1 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:2.0.0:alpha-2:*:*:*:jenkins:*:* Versions 2.0.0 alpha-2 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:2.0.0:beta-2:*:*:*:jenkins:*:* Versions 2.0.0 beta-2 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:2.0.0:beta-3:*:*:*:jenkins:*:* Versions 2.0.0 beta-3 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:2.0.1:*:*:*:*:jenkins:*:* Versions 2.0.1 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:2.0.2:*:*:*:*:jenkins:*:* Versions 2.0.2 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:2.0.3:*:*:*:*:jenkins:*:* Versions 2.0.3 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:2.0.4:*:*:*:*:jenkins:*:* Versions 2.0.4 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:2.1.0:*:*:*:*:jenkins:*:* Versions 2.1.0 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:2.2.0:*:*:*:*:jenkins:*:* Versions 2.2.0 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:2.2.1:*:*:*:*:jenkins:*:* Versions 2.2.1 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:2.2.2:*:*:*:*:jenkins:*:* Versions 2.2.2 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:2.2.3:*:*:*:*:jenkins:*:* Versions 2.2.3 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:2.2.4:*:*:*:*:jenkins:*:* Versions 2.2.4 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:2.2.5:*:*:*:*:jenkins:*:* Versions 2.2.5 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:2.2.6:*:*:*:*:jenkins:*:* Versions 2.2.6 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:2.2.7:*:*:*:*:jenkins:*:* Versions 2.2.7 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:2.2.8:*:*:*:*:jenkins:*:* Versions 2.2.8 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:2.2.9:*:*:*:*:jenkins:*:* Versions 2.2.9 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:2.2.10:*:*:*:*:jenkins:*:* Versions 2.2.10 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:2.2.11:*:*:*:*:jenkins:*:* Versions 2.2.11 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:2.2.12:*:*:*:*:jenkins:*:* Versions 2.2.12 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:2.3.0:*:*:*:*:jenkins:*:* Versions 2.3.0 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:2.3.0:beta-1:*:*:*:jenkins:*:* Versions 2.3.0 beta-1 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:2.3.0:beta-2:*:*:*:jenkins:*:* Versions 2.3.0 beta-2 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:2.3.0:beta-3:*:*:*:jenkins:*:* Versions 2.3.0 beta-3 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:2.3.0:beta-4:*:*:*:jenkins:*:* Versions 2.3.0 beta-4 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:2.3.1:*:*:*:*:jenkins:*:* Versions 2.3.1 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:2.3.2:*:*:*:*:jenkins:*:* Versions 2.3.2 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:2.3.3:*:*:*:*:jenkins:*:* Versions 2.3.3 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:2.3.4:*:*:*:*:jenkins:*:* Versions 2.3.4 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:2.3.5:*:*:*:*:jenkins:*:* Versions 2.3.5 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:2.4.0:*:*:*:*:jenkins:*:* Versions 2.4.0 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:2.4.1:*:*:*:*:jenkins:*:* Versions 2.4.1 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:2.4.2:*:*:*:*:jenkins:*:* Versions 2.4.2 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:2.4.3:*:*:*:*:jenkins:*:* Versions 2.4.3 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:2.4.4:*:*:*:*:jenkins:*:* Versions 2.4.4 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:2.5.0:*:*:*:*:jenkins:*:* Versions 2.5.0 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:2.5.0:beta-1:*:*:*:jenkins:*:* Versions 2.5.0 beta-1 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:2.5.0:beta-2:*:*:*:jenkins:*:* Versions 2.5.0 beta-2 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:2.5.0:beta-3:*:*:*:jenkins:*:* Versions 2.5.0 beta-3 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:2.5.0:beta-4:*:*:*:jenkins:*:* Versions 2.5.0 beta-4 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:2.5.0:beta-5:*:*:*:jenkins:*:* Versions 2.5.0 beta-5 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:2.5.1:*:*:*:*:jenkins:*:* Versions 2.5.1 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:2.5.2:*:*:*:*:jenkins:*:* Versions 2.5.2 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:2.5.3:*:*:*:*:jenkins:*:* Versions 2.5.3 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:2.6.0:*:*:*:*:jenkins:*:* Versions 2.6.0 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:2.6.1:*:*:*:*:jenkins:*:* Versions 2.6.1 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:2.6.2:*:*:*:*:jenkins:*:* Versions 2.6.2 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:2.6.2:beta-1:*:*:*:jenkins:*:* Versions 2.6.2 beta-1 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:2.6.2:beta-2:*:*:*:jenkins:*:* Versions 2.6.2 beta-2 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:2.6.4:*:*:*:*:jenkins:*:* Versions 2.6.4 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:2.6.5:*:*:*:*:jenkins:*:* Versions 2.6.5 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:3.0.0:*:*:*:*:jenkins:*:* Versions 3.0.0 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:3.0.0:beta-1:*:*:*:jenkins:*:* Versions 3.0.0 beta-1 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:3.0.0:beta-2:*:*:*:jenkins:*:* Versions 3.0.0 beta-2 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:3.0.1:*:*:*:*:jenkins:*:* Versions 3.0.1 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:3.0.2:*:*:*:*:jenkins:*:* Versions 3.0.2 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:3.0.2:beta-1:*:*:*:jenkins:*:* Versions 3.0.2 beta-1 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:3.0.2:beta-2:*:*:*:jenkins:*:* Versions 3.0.2 beta-2 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:3.0.3:*:*:*:*:jenkins:*:* Versions 3.0.3 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:3.0.4:*:*:*:*:jenkins:*:* Versions 3.0.4 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:3.0.5:*:*:*:*:jenkins:*:* Versions 3.0.5 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:3.1.0:*:*:*:*:jenkins:*:* Versions 3.1.0 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:3.2.0:*:*:*:*:jenkins:*:* Versions 3.2.0 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:3.3.0:*:*:*:*:jenkins:*:* Versions 3.3.0 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:3.3.1:*:*:*:*:jenkins:*:* Versions 3.3.1 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:3.4.0:alpha-1:*:*:*:jenkins:*:* Versions 3.4.0 alpha-1 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:3.4.0:alpha-4:*:*:*:jenkins:*:* Versions 3.4.0 alpha-4 Vulnerable ·Jenkins
- cpe:2.3:a:jenkins:git:3.4.0:beta-1:*:*:*:jenkins:*:* Versions 3.4.0 beta-1 Vulnerable ·Jenkins
Remediation
- Fix · GHSA-rf5q-8gx3-xqfc org.jenkins-ci.plugins:git (Maven) Fixed in 3.3.2 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift Enterprise 3 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 3.6 | Fixed | — |
Timeline
- 2026-10-02 Threatist record created from CVE-2017-1000092
- 2026-10-03 Alias added: GHSA-rf5q-8gx3-xqfc
References
More Jenkins Git vulnerabilities
- TI-2022-17098 Missing authorization in Jenkins Git Plugin CVSS 3.1HIGH 7.5
- TI-2022-17097 Cross-site request forgery in Jenkins Git Plugin CVSS 3.1HIGH 8.8
- TI-2022-13003 Path traversal in Jenkins Git Plugin CVSS 3.1HIGH 7.5
- TI-2022-18196 Insufficiently protected credentials in Jenkins Git Plugin CVSS 3.1MEDIUM 6.5
- TI-2018-15763 An improper authorization vulnerability exists in Jenkins Git Plugin version 3.7.0 and… CVSS 3.0MEDIUM 5.3
- TI-2021-04764 Improper output encoding in Jenkins Git Plugin CVSS 3.1MEDIUM 6.1
Sources
- CVE-2017-1000092 · CVE Program
- CVE-2017-1000092 · NVD
- FIRST EPSS
- GHSA-rf5q-8gx3-xqfc · GitHub Advisory Database · CC BY 4.0
- CVE-2017-1000092 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences